ISO/IEC 29167-16:2022

Overview - ISO/IEC 29167-16:2022 (ECDSA‑ECDH crypto suite for air interface)

ISO/IEC 29167-16:2022 defines a public‑key crypto suite based on elliptic curve cryptography (ECC) for RFID air interfaces in the ISO/IEC 18000 family. The standard specifies use of ECDH (Elliptic Curve Diffie‑Hellman) for secure channel establishment and ECDSA (Elliptic Curve Digital Signature Algorithm) for mutual authentication between a Tag and an Interrogator (reader). It is intended as a high‑weight security protocol, particularly for active RFID systems requiring strong cryptographic protections. This second edition (2022) updates references and aligns the suite with existing air interface parameters.

Key topics and technical requirements

• Crypto primitives: ECDSA for entity authentication and ECDH for key agreement (ECDSA‑ECDH crypto suite).
• Mutual authentication: Protocols and message formats for mutual authenticate messages (MAM), including Authenticate(MAM1.1 / MAM1.2) and associated responses.
• Secure channel establishment: Use of ECDH to derive session keys (SEK, SIK) for confidential and integrity‑protected communication.
• Message and response formats: Mandatory and optional message structures; Tags and Interrogators must clearly declare supported options.
• Conformance rules: Devices claiming conformance must implement mandatory messages and comply with ISO/IEC 18000 air interface requirements; optional parameters may be selectively implemented.
• Operational mechanics included: State diagram, initialization/reset behavior, authentication procedures, fragmentation/defragmentation, and error codes.
• Supporting material: Parameter definitions, certificate format, test vectors, examples of ECC parameters, and guidance on Trusted Third Party (TTP) usage.
• Limitations: Key update is not supported by this document - long‑term key management considerations must be handled externally.
• Security focus: Designed as a high‑weight protocol suited to scenarios with elevated security requirements for RFID air interfaces.

Practical applications and users

Who benefits from ISO/IEC 29167-16:

• RFID system designers implementing secure air interfaces for asset tracking, logistics, supply chain security.
• Tag and Interrogator (reader) manufacturers seeking standardized ECC‑based authentication and secure channel services.
• Security architects and integrators deploying active RFID in sensitive environments (industrial IoT, critical infrastructure).
• Conformance and test laboratories using the document’s test vectors and conformance rules to validate implementations.
• Standards and procurement teams specifying high‑security RFID solutions that align with ISO/IEC 18000 protocols.

Related standards (normative and informative)

• ISO/IEC 18000‑4 (RFID air interface at 2,45 GHz)
• ISO/IEC 29167‑1 (AIDC security services for RFID air interfaces)
• ISO/IEC 11770‑3, 11770‑6 (Key management; key derivation)
• ISO/IEC 9798‑3, 14888‑3 (Entity authentication and digital signatures)
• ISO/IEC 18031, 18033‑3, 9797‑3 (Random generation, encryption, MACs)

ISO/IEC 29167‑16 is essential for stakeholders implementing ECC‑based authentication and secure channels on RFID air interfaces, providing a prescriptive, interoperable approach to strong RFID security.